1. Field of the Invention
The present invention relates to a process for protecting a station""s accesses to at least one server and a device which implements the process.
2. Description of Related Art
The need to protect the communications between servers and stations in communication networks is known, especially when these communications involve sensitive information for applications executed in the station in cooperation with the server. Up to now the protection principle consisted of adding, between the application and the layers of communication protocols in the network, part of a protection program. This program layer was installed both in the terminal and in the server. The disadvantage of such a method is that it requires a modification of the applications or the telecommunication layers and a program part for producing the interface between the protection program itself and the specific application. Thus, for each application, it is necessary to develop a specific program interface. Moreover, each server, insofar as the terminal is connected to a multiserver network, must be protected. The programming time necessary to protect each server would be a heavy burden on the budget required to protect an application.
The object of the invention is to propose a protection process which does not require any modification of the application programs executed in the terminals or any modification of the servers.
This object is achieved by the fact that the process makes it possible to protect the accesses originating from user stations whose destination is at least one application server linked through a network using a multisession, multiport telecommunication protocol, which process consists of a step for the systematic establishment of a parallel security session between the user station and a security processor interposed between the user station to be protected during application sessions and the server or servers to be protected, and a step for the cyclic initiation of security sessions.
According to another characteristic, the step for the systematic establishment of a security session includes the following steps:
transmission by the station through the network of a source IP address and at least one port number associated with the application requested by the station;
a search by the security processor for the security script associated with the application;
establishment of the security session between the security processor and the station; a search by the security processor in a local file of the processor for the name and address of the remote server used for the application and the opening of a connection with the remote server by communicating an IP address and a port number.
According to another characteristic, the script associated with an application consists of directly establishing the link between the station and the remote server chosen by the security processor.
According to another characteristic, the security script to be implemented, defined in a stored table, makes it possible to choose one or more of the following functionsxe2x80x94user authentication, identification, verification of the user""s rights, certification, encryption key calculation, signature calculation, verification of user profilesxe2x80x94to provide selective access to the applications requested from the server.
According to another characteristic, the security processor stores a journal in a mass memory comprising a sequential connection number, the connection dates and beginning and end times, the source IP address and at least one port number, the identifier of the security object used, the name of the remote server chosen, the destination IP address and port number, and the execution rules.
According to another characteristic, the security processor stores in a second table of a memory a list of the applications processed by the processor, the operations to be executed as a function of the connection type, the security scripts to be implemented, the access rights of the users as defined by a black list, a white list and a subscriber list, and the schedules for the authorization of access to the remote servers.
Another object of the invention is to propose a device which makes it possible to implement this process.
This object is achieved by the fact that the device enables the process to be implemented between, on the one hand, a terminal in which is installed security software which manages the exchanges with the card and a card reader associated with the terminal as well as the exchanges with a multisession, multiport communications protocol, and on the other hand a security processor, characterized in that the security processor includes means for establishing and controlling communications between the station and a server chosen by the processor as a function of the application requested by the station.
According to another characteristic, the means for establishing and controlling communications make it possible either to establish direct communication between the terminal and the server, or to establish communication between the terminal and the server after establishing a security session controlled by a security device which comprises a microprocessor equipped with the memories required for its operation and which communicates with security control modules SAM which enable the security scripts to be interpreted, as determined by a main processor which executes the communication server and security engine programs.
According to another characteristic, the means for establishing communications are constituted by two local network cards such as, for example, Ethernet or token ring cards, one of which is linked to the station, while the other is linked to the server and communicates with the station and the server using the multisession, multiport communication protocol.